Countermeasures

Question 1

How to prevent buffer overflows?

Answer 1

• Write decent programs
• Use language with boundary checking
• Perform an analysis before (static) or during (dynamic) execution
• Modify how programs are loaded and executed by kernel

Question 2

What are the special and safe languages?

Answer 2

Interpreted languages
- Cyclone
- CCured

Question 3

What are the tools for static analysis?

Answer 3

• Splint
• Cqual
• Metacompilation
• PREfix / PREfast
• BOON
• ITS4, Flawfinder, RATS

Question 4

What are the tools for dynamic analysis?

Answer 4

• Purify
• Valgrind
• Information flow / taint analysis

Question 5

What are the substitutes for libc ?

Answer 5

• LibSafe
• Contra Police

Question 6

What is the goal of the containment approach?

Answer 6

To limit the damage that a hijacked application can cause
(policy enforcement and sandboxing)

Question 7

What are the detection approaches?

Answer 7

System call analysis: signatures, sequences, control-flow-driven analysis, parameter modelling
Mimicry attacks
Compiler Modifications: boundary checking and integrity checking

Question 8

What is StackGuard?

Answer 8

Canary-based solution: a terminator, random or XOR canary is written before return address on the stack.
This value is verified during epilogue before performing return instruction.

Question 9

What is non-executable memory?

Answer 9

Use stack/heap for storing data not code so it does not need to be executable, if we try to execute code in these regions, it will cause a segmentation fault.
Can be bypassed by return-into-libc attack

Question 10

What is return-into-libc?

Answer 10

Existing code in standard C library is used instead of injecting and executing shellcode on the stack. Return address over written with address of a libc function. Attacker can execute arbitrary commands by controlling arguments asked into function (e.g. system(“/bin/sh”))

Question 11

What is ASLR?

Answer 11

Address space layout randomisation randomises the position of the heap, the stack, and the code

Question 12

What is soundness?

Answer 12

If analysis says that X is true, then X is true
If the program is claimed to be error free, then it really is
No false alarms

Question 13

What is completeness?

Answer 13

If X is true, then analysis says X is true
If the program is claimed to be erroneous, then it really is
May get false alarms